Google, Facebook: “do not track” bill a threat to California economy

Google, Facebook and a platoon of advertising companies are reading the riot …

Google and Facebook are warning legislators of dire consequences if California passes a "do not track" bill. The proposed law would require companies doing online business in the Golden State to offer an "opt-out" privacy mechanism for consumers.

Senate Bill 761 "would create an unnecessary, unenforceable and unconstitutional regulatory burden on Internet commerce," says the letter in opposition to the measure. "The measure would negatively affect consumers who have come to expect rich content and free services through the Internet, and would make them more vulnerable to security threats."

Signed: Google, Facebook, Time Warner Cable, CTIA - The Wireless Association, the California Chamber of Commerce, and about thirty other associations and companies.

A method for consumers

The legislation in question comes from the office of state senator Alan Lowenthal (D-Long Beach). Lowenthal's bill would require the state's Attorney General to deploy regulations by July 1, 2012 forcing any business that uses, collects, or stores online data to offer California consumers "a method to opt out of that collection, use, and storage of such information."

According to its summary, the bill would specify:

that such information, includes, but is not limited to, the online activity of an individual and other personal information. The bill would subject these regulations to certain requirements, including, but not limited to, a requirement that a covered entity disclose to a consumer certain information relating to its collection, use, and storage information practices. The bill would, to the extent consistent with federal law, prohibit a covered entity from selling, sharing, or transferring a consumer's covered information. The bill would make a covered entity that willfully fails to comply with the adopted regulations liable to a consumer in a civil action for damages, as specified, and would require such an action to be brought within a certain time period.

What would this "covered information" include? The "date and hour of online access," the location from which the information was accessed, the "means" (presumably the broadband device and its operating system) by which the data was obtained and stored, the user's IP address, "personal information" that would include but not be limited to postal and e-mail addresses, and government identification numbers such as drivers' licenses, passport numbers, and tax IDs. Credit card numbers and security codes are also part of the definition.

Entities that do not collect "sensitive information" would be exempt from the law, however. These are defined as services that do not obtain and store information that relates directly to a consumer's medical history, ethnicity, religion, sexual orientation, or financial status.

Google/Facebook's case against 761

Google, Facebook, and company argue against this bill on a variety of grounds. First, they claim that various California laws already protect the privacy of online consumers. Although none are mentioned in the letter, laws like the Consumer Protection Against Computer Spyware Act bars enterprises from deceptively collecting personally identifiable information.

"All of these laws also contain important exceptions and balances so that they are workable," the letter contends. "SB 761 contains none of these limitations, and instead leaves the Attorney General's office the complex and delicate task of figuring out what to exempt."

Second, the letter points out that the four leading Web browsers—Internet Explorer, Firefox, Safari, and Google Chrome—already offer various means of preventing advertising companies from tracking users. Firefox's private browsing mechanism and Chrome's "incognito" windows would be examples of these, and some browsers are now supporting "do not track" headers as well. The letter also cites self-regulatory programs such as the Network Advertising Initiative and the Digital Advertising Alliance, which offer "easy-to-use mechanisms to opt out of interest-based advertising from more than 60 companies."

"The Federal Trade Commission and Department of Commerce have endorsed self-regulation in this area as the preferred policy approach—and these programs in particular, which have broad industry support and which already provide consumers with enhanced transparency and choice far more rapidly than cumbersome rulemaking," the missive adds.

However, the FTC has warned the industry that if self-regulation doesn't work, Federal "do-not-track" regulation is high on the agenda.

Third, the letter says that 761 would hurt California's economy. "California leads the world in Internet commerce; the sector employs an estimated 162,000 people, generates billions of dollars in revenue and is the fastest growing source of jobs in the state," the companies note. "SB 761 would create a second, conflicting set of standards to which companies would have to conform or else face class action lawsuits."

Finally, the companies call the legislation unconstitutional—an inherent appropriation of Congress's authority over interstate commerce, since every non-California-based company that wants to do business with California would have to alter its privacy practices. "As a result, any out-of-state company affected by the law would be entitled to bring a Commerce Clause challenge," they claim.

Analyzing data

To borrow a line from Hamlet's mother, there's a distinct the-lady-doth-protest-too-much quality to this letter—a summoning of everything in the rhetorical kitchen sink that might scare California politicians away from the bill. In fact, Lowenthal's proposed law permits the Attorney General some flexibility. Exemptions can be made on behalf of online companies that are:

(A) Providing, operating, or improving a product or service used, requested, or authorized by an individual, including the ongoing provision of customer service and support.

(B) Analyzing data related to use of the product or service for purposes of improving the products, services, or operations.

[and]

(F) Complying with a federal, state, or local law, regulation, rule, or other applicable legal requirement, including, but not limited to, disclosures pursuant to a court order, subpoena, summons, or other properly executed compulsory process.

Exemption B in particular seems wide enough to drive at least several digital trucks through. But whatever you think about this issue, the letter shines light on the degree to which Facebook and Google not only identify with advertising companies, but see themselves as such companies.

Legislative websites are notoriously slow to update bill status, but the California Senate portal says that Senate Bill 761 has been referred to its Committee on the Judiciary.

If you want something for free you have to pay with your privacy. Otherwise get ready to pay. Maybe offer a Google and Facebook premium. You can use google for free or you can pay 20-50 dollars a month for Google Premium and another 20-50 dollars a month for Facebook premium if you do not want to be tracked etc..

Offer users this kind of option and it will put an end to this whole issue. Now people get a choice.

Second, the letter points out that the four leading Web browsers—Internet Explorer, Firefox, Safari, and Google Chrome—already offer various means of preventing advertising companies from tracking users

This is simply not the same. My browser will not go on their servers and wipe my tracking and usage data! What needs to be done is that we can go to a link on Google and click a box that says 'Wipe all data you have on me, ever had on me, will ever have on me.' and poof, it's gone. All of it. Forever.

THIS is what this bill is about, and people need this. Badly. People need a way to keep their data from being used on these sites. So many sites simply cross link with each other you have no idea. Going to CNN.com may cross link your data with 20+ sites without you even knowing.

Simply not going to a web site to keep your data off of it WILL NOT WORK ANYMORE.

Wow, simply giving me the ability to no longer be tracked will bring about the end of the world! /sarcasm

Also, wouldn't having to comply with this mean they have to hire MORE people? Considering the number of americans registering for enemploymeny spkied again this week, or last week, that wouldnt be a bad thing...

Oh who am I kidding... companies are notoriously cheap. Reshuffle from there and fire from here... heaven forbid they ever weather the storm for a litte while.

For example: How does a do not track system make someone more vulnerable to security threats?

A site could use your location to determine whether you are accessing some account from a known location or an abnormal one. For instance, I have bank accounts that know when I log in with a computer different from one I have used before. But if someone "opts-out" of this, then it makes it harder to track down unauthorized access to an account.

"Signed: Google, Facebook, Time Warner Cable, CTIA - The Wireless Association, the California Chamber of Commerce, and about thirty other associations and companies."

Its quite a group of people...

Not to mention - they are right, what will happen is you will see online commerce organizations based in California move to Nevada... along with their tax money...Ohh and how about actually enforcing this?! I guess this could help their unemployment rate as they would have to hire hundreds if not thousands of people to actually police this...

Fuck them.... consumer privacy is a good thing.They make billions doing the exact opposite, so of course they oppose this.

Well, just get ready to start busting out your wallet on the internet more often. If you are willing to pay up to have a more secure browsing experience then that's great. I don't give a shit if companies track me if it means that I get things like free Gmail and ArsTechnica. Worthwhile trade from my perspective.

My problem isn't with privacy per se, but rather with analytics being used in ways that change the overall fairness of commerce. If an airline can start figuring out what my price sensitivity is to the point that it negatively impacts my fare vs someone else who is purchasing at the exact same time, then I have a problem with having been identified. There was talk of sites that would identify spenders and give them automatic discounts to encourage them to stay a shopper at that site. That is different from having a delineated threshold available to all where after x purchases you get x discount, or signing up for a yearly fee to get preferential service, giving someone a discount simply because they have been identified to be potentially a more lucrative shopper is no longer fair. That is different from targeting advertising to certain demographics to make consumers aware of products, I can't say that such use of information fundamentally bugs me if I had the guarantee that in the end all business is conducted on an equal and fair footing.

For example: How does a do not track system make someone more vulnerable to security threats?

A site could use your location to determine whether you are accessing some account from a known location or an abnormal one. For instance, I have bank accounts that know when I log in with a computer different from one I have used before. But if someone "opts-out" of this, then it makes it harder to track down unauthorized access to an account.

Well, with your bank account, presumably you would not want or be allowed to "opt out" since if you did then having and maintaining an online bank account without your personally identifying data attached would not be possible (of course.)

Well, with your bank account, presumably you would not want or be allowed to "opt out" since if you did then having and maintaining an online bank account without your personally identifying data attached would not be possible (of course.)

So, you've just made an exception to the rule then. How many of these are there and who gets to decide which ones are valid?

Off the top of my head, Steam stores your computer setup and uses that to help prevent 3rd party access by comparing to the stored setup every log-in. Websites can use time and IP to assist in credit card theft to confirm invalid charges. They are not concrete alone, but the entire purpose is to identify trends and also identify departures from those trends.

Just like TV the web is for advertizing and you must be terrorist to not want tracking, I mean you do not expect privacy or the machine you paid for to only cater to your needs; sure you paid for a PC( 'bought' the right to use the machine and any and all software or data at the discretion of our most important citizens- gov and corp) and an internet connection BUT growup your continued bleeding- er- support(ka-ching) to be the only items you are expected to continuously pay for...

My apologies for helping Al Gore... I wanted to use chrome pipes but as gov job the cost was disallowed- money needed to pay for congresses lifetime free health care.

Read the fine print... install any OS or application and you lose your right to anonymity or control(ok there are still a FEW exceptions- and thank you too few).

Well, even if the Bill passed, what would prevent Google, Facebook, et. al. from requiring opt-in to use their services?

I don't think they would lose many users if they did this. We understand that an <a href=”https://www.semantic-ad.com/Austin-Online-Marketing.html”>online marketing company</a> needs to provide tracking information to advertisers, and most consumers are willing to do this.

The advertisers' business model requires that ads be presented only to people who are likely to buy the product or service; and the tracking info enables them to determine this. Without the tracking info, the cost of advertising (which is ultimately borne by the consumer) would be increased significantly.

Obviously, the do-no-track sounds good to me...but I do agree care needs to be taken before making it a law. It's certainly possible to, in the name of consumer protection, create a law that over-reaches its intentions. I don't really have much of a problem with much of the tracking now, anyway. What are they going to learn? That I like chocolate, and where I buy stuff online? Oh noes.

Anyway, it will at least solve stupidity like watching maybelline ads as the mandatory intro clip on joystiq videos. Because I definitely don't use/need Maybelline nail products.

If they are tracking to the extent that not only do they know I like chocolate and stuff, but also know what routes I take from home to work in the morning (thus, where I live and work)..and can pin that info easily to me, then that is a problem. However, I think they anonymize that stuff... if for no other reason than the fact that it's a huge liability.

In fact, I'm fine with companies using my "circumstantial" data. If I can ask people on the street about stuff--or even just observe them--and use that information without penalty, why can't that happen online? The problem is when the information is misused. I'd rather see harsh penalties there as a deterrent. A couple more breaches like the Sony one, and companies will be terrified to keep non-anonymized data for any appreciable length of time.

IMO, they are overvaluing this data anyway. In the series Caprica, a person's entire consciousness, memories, and personality is basically reconstructed from logs of their online habits. That's ridiculous. This information is only useful in aggregate form, and doesn't really scale well at the individual level anyway.

All these companies share and trade our information for a price. For once I would like to be able to sell my information for a price. How come they never offer me money for my information. Eg My email address is worth a 1.00, a name to go with it 2.00, where I shop .25 cents per store. Good for two years and renewable at my discretion. This would be a good starting point.

"The measure would negatively affect consumers who have come to expect rich content and free services through the Internet, and would make them more vulnerable to security threats."

I'd love to see this statement broken down and explained in detail.

For example: How does a do not track system make someone more vulnerable to security threats?

Well, just imagine how terrible the Sony breach would have been if they didn't have a bunch of personal information about their users. Oh the horror!

It would have been as bad. The issue is with the fact that they needed most of that sensitive info to offer the service. It's like complaining that PayPal has too much info, but not thinking that they essentially need that info to offer their service.

Problem is not what info Google/Facebook have, but the fact that they are not transparent about it in many ways. In fact, most indirect info that Google has on you, probably couldn't identify you personally out of 10 people in a lineup.

So what is needed is information transparency requirement. And "You work with my data, please provide me with information on how you store it, how you secure it, what information you store and why you need it."

If you want something for free you have to pay with your privacy. Otherwise get ready to pay. Maybe offer a Google and Facebook premium

Odd, broadcast radio and TV can present ads without tracking me and make money doing it.

A) How are those tampon ads for you? Or E/D medication ads?B) TV advertisement is horribly overpriced for anyone but the biggest company. With Google more businesses can advertise.

exactly! I LIKE being tracked with the option to say, bugger off you don't need to track me for a bit. I'd rather see electronics ads than tampon ads. Hell, I would PAY to never see another damn gap ad again. Video game ads vs car ads? SURE! I'll let you see what my interests are so you can go through the effort of catering to me. If google knew my favorite casino's in vegas, I'd rather get an ad on a webpage for upcoming poker tournaments than get a letter in the mail. In some respects they need better integration, and I give that idea to you for free google, no need for me to patent it,

It will be ruled unconstitutional under the commerce clause. California should save itself the money it would lose defending it: It needs every dime it can get now.

It is pretty straight forward. But, just because it's a waste of time and money doesn't mean the California legislature won't pursue it. In fact, simply because it is a waste of time and money, the California legislature must pursue it. That's my guvmnt for ya, God love 'em

Facebook and Google offer their services for free. You are using THEIR service. If you don't like they way its done you already have an option to not be tracked. Its the the universally applicable "GTFO Plan," offered free-of-charge.

This isn't like the broadband monopoly where no other search engine is available in your area. The internet has search engines that don't track. Choice exists on the internet: make use of it.

Wow, simply giving me the ability to no longer be tracked will bring about the end of the world! /sarcasm

Also, wouldn't having to comply with this mean they have to hire MORE people? Considering the number of americans registering for enemploymeny spkied again this week, or last week, that wouldnt be a bad thing...

Oh who am I kidding... companies are notoriously cheap. Reshuffle from there and fire from here... heaven forbid they ever weather the storm for a litte while.

Well, even if the Bill passed, what would prevent Google, Facebook, et. al. from requiring opt-in to use their services?

I don't think they would lose many users if they did this. We understand that an <a href=”https://www.semantic-ad.com/Austin-Online-Marketing.html”>online marketing company</a> needs to provide tracking information to advertisers, and most consumers are willing to do this.

The advertisers' business model requires that ads be presented only to people who are likely to buy the product or service; and the tracking info enables them to determine this. Without the tracking info, the cost of advertising (which is ultimately borne by the consumer) would be increased significantly.

Most people don't care when they are not made aware of the implications. Consider that if Google starts requiring opt-in to data mining and tracking for new GMail subscribers, at least some people would shy away at seeing the terms explicitly.

Moreover--and I believe this is their real fear--it takes only one single competitor, say Apple, to come along with a recruitment offer that says, "no opt-in to tracking needed... we don't do it!" for people to start making immediate judgement on their preferred providers.

1. This bill doesn't prohibit tracking. It just requires an "opt-out" provision. And if opting out means you can't use the service (or you get the same amount of ads, but random ones), that's an appropriate trade off.

2. The bill is not unconstitutional. It only applies to California residents and to companies doing business in California. There's no commerce clause issue (although there clearly *could be* if they tried to apply it to businesses with no presence in California. Depending).

Slightly off-topic, but I have to wonder what good most online ads do anyway. I mean, have you ever clicked on one intentionally? To me they're the same as email spam or telemarketing calls. I just delete or ignore. I would never, ever buy something or give money as a result of any of those, so they're just wasting their time with me. In fact, if an ad does happen to get my attention, I'm less likely to purchase or use that product or service.

Slightly off-topic, but I have to wonder what good most online ads do anyway. I mean, have you ever clicked on one intentionally? To me they're the same as email spam or telemarketing calls. I just delete or ignore. I would never, ever buy something or give money as a result of any of those, so they're just wasting their time with me. In fact, if an ad does happen to get my attention, I'm less likely to purchase or use that product or service.

Merely brining a product to your awareness will influence your decisions later. There are no shortage of studies to back this up. I believe the effect is called "priming" (though I might be thinking of something else). Even if you don't buy it at the computer, you will be more inclined to buy it later at a store, or to believe the quality is higher because it has an advertising budget, etc.

Basically, psychology says your last sentence is wrong, and there is nothing you can do about it.

Matthew Lasar / Matt writes for Ars Technica about media/technology history, intellectual property, the FCC, or the Internet in general. He teaches United States history and politics at the University of California at Santa Cruz.